AC1750 (Archer A7 v5) can't get back to stock firmware

Hi,

I want to revert a router to the stock firmware and it's not going good. I've tried:

  1. Install firmware from the official website
  2. Install an old version from the official website that is hosted on DD-WRT Wiki about Archer A7
  3. Change OpenWRT to DD-WRT (successfully) and try from there
  4. Remove u-boot from the firmware (0xFEC9) from the official website and install
  5. Remove u-boot from the firmware (0xFCBE) from the DD-WRT Wiki version

and no luck so far. It just uploads and does nothing. Later, loads to the current firmware (either OpenWRT or DD-WRT).

I assume I remove wrong blocks (u-boot) from the stock firmware?

Did you try TFTP?

That’s how all attempts were made. It successfully uploads all possible firmware but installs only OpenWRT and DD-WRT. It doesn’t work for the stock one. I assume because of the boot header. I’ve tried to remove it, but no difference. I suspect I could be removing the wrong size of the header.

Here is a binwalk from https://wiki.dd-wrt.com/wiki/index.php/TP_Link_Archer_A7v5 recovery file

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
21876         0x5574          U-Boot version string, "U-Boot 1.1.4-g817a97f4-dirty (Jan 23 2019 - 10:21:04)"
21940         0x55B4          CRC32 polynomial table, big endian
23232         0x5AC0          uImage header, header size: 64 bytes, header CRC: 0xDA2E53A0, created: 2019-01-23 02:21:05, image size: 40183 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0xDE24A9B9, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
23296         0x5B00          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 95068 bytes
63480         0xF7F8          uImage header, header size: 64 bytes, header CRC: 0xB926F69D, created: 2019-01-24 08:07:08, image size: 1087181 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0x7FE0461A, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.3.8"
63552         0xF840          LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3164060 bytes
1150726       0x118F06        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 14392645 bytes, 1975 inodes, blocksize: 65536 bytes, created: 2019-04-03 12:15:11
15543817      0xED2E09        XML document, version: "1.0"
15556770      0xED60A2        gzip compressed data, from Unix, last modified: 2019-01-25 08:55:51

Would be this cut correct?

dd if=original.bin of=ArcherC7v5_tp_recovery skip=7935 bs=8

Bump for visibility